YARA rules for CORESHELL
24 rules · scoped to tool · back to CORESHELL
YARA rules whose family, name, or description matches this tool or its tooling. Use these for binary-pattern hunts.
rule Sofacy_Malware_StrangeSpaces {
meta:
description = "Detetcs strange strings from Sofacy malware with many spaces"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
date = "2015-12-04"
id = "60f99b88-f256-5289-852c-c0bf27f1cbd4"
strings:
$s2 = "Delete Temp Folder Service " fullword wide
$s3 = " Operating System " fullword wide
$s4 = "Microsoft Corporation " fullword wide
$s5 = " Microsoft Corporation. All rights reserved. " fullword wide
condition:
uint16(0) == 0x5a4d and filesize < 50KB and 3 of them
}
rule Sofacy_Malware_AZZY_Backdoor_1 {
meta:
description = "AZZY Backdoor - Sample 1"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
date = "2015-12-04"
hash = "a9dc96d45702538c2086a749ba2fb467ba8d8b603e513bdef62a024dfeb124cb"
id = "184dc45e-8014-5dcf-a033-d77586c60fdf"
strings:
$s0 = "advstorshell.dll" fullword wide
$s1 = "advshellstore.dll" fullword ascii
$s2 = "Windows Advanced Storage Shell Extension DLL" fullword wide
condition:
uint16(0) == 0x5a4d and filesize < 150KB and 2 of them
}
rule Sofacy_AZZY_Backdoor_Implant_1 {
meta:
description = "AZZY Backdoor Implant 4.3 - Sample 1"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
date = "2015-12-04"
hash = "1bab1a3e0e501d3c14652ecf60870e483ed4e90e500987c35489f17a44fef26c"
id = "ec6bf8ca-ccb9-532e-8b0d-1fba59efa2da"
strings:
$s1 = "\\tf394kv.dll" wide
$s2 = "DWN_DLL_MAIN.dll" fullword ascii
$s3 = "?SendDataToServer_2@@YGHPAEKEPAPAEPAK@Z" ascii
$s4 = "?Applicate@@YGHXZ" ascii
$s5 = "?k@@YGPAUHINSTANCE__@@PBD@Z" ascii
condition:
uint16(0) == 0x5a4d and filesize < 300KB and 2 of them
}
rule Sofacy_AZZY_Backdoor_HelperDLL {
meta:
description = "Dropped C&C helper DLL for AZZY 4.3"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
date = "2015-12-04"
hash = "6cd30c85dd8a64ca529c6eab98a757fb326de639a39b597414d5340285ba91c6"
id = "eae089a0-21dc-5d6e-a4bc-7181dc9b8b35"
strings:
$s0 = "snd.dll" fullword ascii
$s1 = "InternetExchange" fullword ascii
$s2 = "SendData"
condition:
uint16(0) == 0x5a4d and filesize < 100KB and all of them
}
rule Sofacy_CollectorStealer_Gen1 {
meta:
description = "Generic rule to detect Sofacy Malware Collector Stealer"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
date = "2015-12-04"
super_rule = 1
hash1 = "4e4606313c423b681e11110ca5ed3a2b2632ec6c556b7ab9642372ae709555f3"
hash2 = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
id = "f9462dd9-f6b6-59f4-a443-12d6f3be444e"
strings:
$s0 = "NvCpld.dll" fullword ascii
$s1 = "NvStop" fullword ascii
$s2 = "NvStart" fullword ascii
condition:
uint16(0) == 0x5a4d and filesize < 300KB and all of them
}
rule Sofacy_CollectorStealer_Gen2 {
meta:
description = "File collectors / USB stealers - Generic"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
date = "2015-12-04"
hash = "e917166adf6e1135444f327d8fff6ec6c6a8606d65dda4e24c2f416d23b69d45"
hash = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
hash = "b1f2d461856bb6f2760785ee1af1a33c71f84986edf7322d3e9bd974ca95f92d"
id = "03ced94f-de20-56c5-bf17-1ec7d8610684"
strings:
$s1 = "msdetltemp.dll" fullword ascii
$s2 = "msdeltemp.dll" fullword wide
$s3 = "Delete Temp Folder Service" fullword wide
condition:
uint16(0) == 0x5a4d and filesize < 100KB and 2 of them
}
rule Sofacy_CollectorStealer_Gen3 {
meta:
description = "File collectors / USB stealers - Generic"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
date = "2015-12-04"
hash = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
hash = "4e4606313c423b681e11110ca5ed3a2b2632ec6c556b7ab9642372ae709555f3"
id = "d2ee1a22-6aae-51fc-9043-a7ba99769376"
strings:
$s1 = "NvCpld.dll" fullword ascii
$s4 = "NvStart" fullword ascii
$s5 = "NvStop" fullword ascii
$a1 = "%.4d%.2d%.2d%.2d%.2d%.2d%.2d%.4d" fullword wide
$a2 = "IGFSRVC.dll" fullword wide
$a3 = "Common User Interface" fullword wide
$a4 = "igfsrvc Module" fullword wide
$b1 = " Operating System " fullword wide
$b2 = "Microsoft Corporation " fullword wide
condition:
uint16(0) == 0x5a4d and filesize < 150KB and
( all of ($s*) and (all of ($a*) or all of ($b*)))
}
rule Sofacy_Campaign_Mal_Feb18_cdnver {
meta:
description = "Detects Sofacy malware"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "https://twitter.com/ClearskySec/status/960924755355369472"
date = "2018-02-07"
hash1 = "12e6642cf6413bdf5388bee663080fa299591b2ba023d069286f3be9647547c8"
id = "a5c72ddd-91b0-5410-9d81-38a138ec7efe"
strings:
$x1 = "cdnver.dll" fullword wide
$x2 = { 25 73 0A 00 00 00 00 00 30 00 00 00 20 00 2D 00
20 00 00 00 0A 00 00 00 25 00 73 00 00 00 00 00
69 00 6D 00 61 00 67 00 65 00 2F 00 6A 00 70 00
65 00 67 }
$s1 = "S7%s - %lu" fullword ascii
$s2 = "SNFIRNW" fullword ascii
condition:
uint16(0) == 0x5a4d and filesize < 90KB and (
pe.imphash() == "01f3d0fe6fb9d9df24620e67afc143c7" or
1 of ($x*) or
2 of them
)
}
rule Sofacy_Trojan_Loader_Feb18_1 {
meta:
description = "Sofacy Activity Feb 2018"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "https://www.reverse.it/sample/e3399d4802f9e6d6d539e3ae57e7ea9a54610a7c4155a6541df8e94d67af086e?environmentId=100"
date = "2018-03-01"
hash1 = "335565711db93cd02d948f472c51598be4d62d60f70f25a20449c07eae36c8c5"
id = "358d7a77-0ff5-572e-9cd8-b2cebaace02f"
strings:
$x1 = "%appdata%\\nad.dll" fullword wide
$s3 = "%appdata%\\nad.bat" fullword wide
$s1 = "apds.dll" fullword ascii
$s2 = "nad.dll\"" fullword ascii
condition:
uint16(0) == 0x5a4d and filesize < 300KB and (
pe.imphash() == "a2d1be6502b4b3c28959a4fb0196ea45" or
pe.exports("VidBitRpl") or
1 of ($x*) or
2 of them
)
}
rule APT_ATP28_Sofacy_Indicators_May19_1 {
meta:
description = "Detects APT28 Sofacy indicators in samples"
author = "Florian Roth (Nextron Systems)"
reference = "https://twitter.com/cyb3rops/status/1129647994603790338"
date = "2019-05-18"
score = 60
hash1 = "80548416ffb3d156d3ad332718ed322ef54b8e7b2cc77a7c5457af57f51d987a"
hash2 = "b40909ac0b70b7bd82465dfc7761a6b4e0df55b894dd42290e3f72cb4280fa44"
id = "ca768b60-7094-537a-b848-28bd42555287"
strings:
$x1 = "c:\\Users\\user\\Desktop\\openssl-1.0.1e_m\\/ssl/cert.pem" ascii
$x2 = "C:\\Users\\User\\Desktop\\Downloader_Poco" ascii
$s1 = "w%SystemRoot%\\System32\\npmproxy.dll" fullword wide
$op0 = { e8 41 37 f6 ff 48 2b e0 e8 99 ff ff ff 48 8b d0 }
$op1 = { e9 34 3c e3 ff cc cc cc cc 48 8d 8a 20 }
$op2 = { e8 af bb ef ff b8 ff ff ff ff e9 f4 01 00 00 8b }
condition:
uint16(0) == 0x5a4d and filesize < 10000KB and (
pe.imphash() == "f4e1c3aaec90d5dfa23c04da75ac9501" or
1 of ($x*) or
( $s1 and 2 of ($op*) )
)
}
rule Sofacy_Jun16_Sample1 {
meta:
description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "http://goo.gl/mzAa97"
date = "2016-06-14"
score = 85
hash1 = "be1cfa10fcf2668ae01b98579b345ebe87dab77b6b1581c368d1aba9fd2f10a0"
id = "62b577e3-7ccb-59df-a944-96ffe9b16d3d"
strings:
$s1 = "clconfg.dll" fullword ascii
$s2 = "ASijnoKGszdpodPPiaoaghj8127391" fullword wide
condition:
( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($s*) ) ) or ( all of them )
}
rule Sofacy_Jun16_Sample2 {
meta:
description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "http://goo.gl/mzAa97"
date = "2016-06-14"
score = 85
hash1 = "57d230ddaf92e2d0504e5bb12abf52062114fb8980c5ecc413116b1d6ffedf1b"
hash2 = "69940a20ab9abb31a03fcefe6de92a16ed474bbdff3288498851afc12a834261"
hash3 = "aeeab3272a2ed2157ebf67f74c00fafc787a2b9bbaa17a03be1e23d4cb273632"
id = "21561e13-a190-565e-a08b-e6a07c84c3db"
strings:
$x1 = "DGMNOEP" fullword ascii
$x2 = "/%s%s%s/?%s=" fullword ascii
$s1 = "Control Panel\\Dehttps=https://%snetwork.proxy.ht2" fullword ascii
$s2 = "http=http://%s:%Control Panel\\Denetwork.proxy.ht&ol1mS9" fullword ascii
$s3 = "svchost.dll" fullword wide
$s4 = "clconfig.dll" fullword wide
condition:
( uint16(0) == 0x5a4d and filesize < 100KB and ( all of ($x*) ) ) or ( 3 of them )
}
rule Sofacy_Jun16_Sample3 {
meta:
description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "http://goo.gl/mzAa97"
date = "2016-06-14"
score = 85
hash1 = "c2551c4e6521ac72982cb952503a2e6f016356e02ee31dea36c713141d4f3785"
id = "f97bc840-0d9a-5a9e-9e13-7b7f8acc53a5"
strings:
$s1 = "ASLIiasiuqpssuqkl713h" fullword wide
condition:
uint16(0) == 0x5a4d and filesize < 200KB and $s1
}
rule apt_sofacy_xtunnel {
meta:
author = "Claudio Guarnieri"
description = "Sofacy Malware - German Bundestag"
score = 75
id = "aef091b5-cedf-5443-ab61-8b2dbc7e77fd"
strings:
$xaps = ":\\PROJECT\\XAPS_"
$variant11 = "XAPS_OBJECTIVE.dll" $variant12 = "start"
$variant21 = "User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0"
$variant22 = "is you live?"
$mix1 = "176.31.112.10"
$mix2 = "error in select, errno %d" $mix3 = "no msg"
$mix4 = "is you live?"
$mix5 = "127.0.0.1"
$mix6 = "err %d"
$mix7 = "i`m wait"
$mix8 = "hello"
$mix9 = "OpenSSL 1.0.1e 11 Feb 2013" $mix10 = "Xtunnel.exe"
condition:
((uint16(0) == 0x5A4D) or (uint16(0) == 0xCFD0)) and (($xaps) or (all of ($variant1*)) or (all of ($variant2*)) or (6 of ($mix*)))
}
rule Sofacy_Mal2 {
meta:
description = "Sofacy Group Malware Sample 2"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
date = "2015-06-19"
hash = "566ab945f61be016bfd9e83cc1b64f783b9b8deb891e6d504d3442bc8281b092"
score = 70
id = "1547cc67-7d7c-5ec9-816c-15b7d523376a"
strings:
$x1 = "PROJECT\\XAPS_OBJECTIVE_DLL\\" ascii
$x2 = "XAPS_OBJECTIVE.dll" fullword ascii
$s1 = "i`m wait" fullword ascii
condition:
uint16(0) == 0x5a4d and ( 1 of ($x*) ) and $s1
}
rule Sofacy_Mal3 {
meta:
description = "Sofacy Group Malware Sample 3"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
date = "2015-06-19"
modified = "2023-01-06"
hash = "5f6b2a0d1d966fc4f1ed292b46240767f4acb06c13512b0061b434ae2a692fa1"
score = 70
id = "67d002ef-4ed9-54ce-a6ef-49b7f3b951e2"
strings:
$s1 = "shell\\open\\command=\"System Volume Information\\USBGuard.exe\" install" fullword ascii
$s2 = ".?AVAgentModuleRemoteKeyLogger@@" fullword ascii
$s3 = "<font size=4 color=red>process isn't exist</font>" fullword ascii
$s4 = "<font size=4 color=red>process is exist</font>" fullword ascii
$s5 = ".winnt.check-fix.com" ascii
$s6 = ".update.adobeincorp.com" ascii
$s7 = ".microsoft.checkwinframe.com" ascii
$s8 = "adobeincorp.com" fullword wide
$s9 = "# EXC: HttpSender - Cannot create Get Channel!" fullword ascii
$x1 = "User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:20.0) Gecko/20100101 Firefox/" wide
$x2 = "User-Agent: Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/2" wide
$x3 = "C:\\Windows\\System32\\cmd.exe" fullword wide
condition:
uint16(0) == 0x5a4d and filesize < 300KB and (
2 of ($s*) or
( 1 of ($s*) and all of ($x*) )
)
}
rule Sofacy_Bundestag_Batch {
meta:
description = "Sofacy Bundestags APT Batch Script"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
date = "2015-06-19"
score = 70
id = "869dafec-1387-5640-b608-b84cf0d43342"
strings:
$s1 = "for %%G in (.pdf, .xls, .xlsx, .doc, .docx)" ascii
$s2 = "cmd /c copy"
$s3 = "forfiles"
condition:
filesize < 10KB and 2 of them
}
rule Sofacy_Oct17_1 {
meta:
description = "Detects Sofacy malware reported in October 2017"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "http://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"
date = "2017-10-23"
hash1 = "522fd9b35323af55113455d823571f71332e53dde988c2eb41395cf6b0c15805"
id = "6896dcf3-e422-5a40-bc1e-d1f35ae95c14"
strings:
$x1 = "%localappdata%\\netwf.dll" fullword wide
$x2 = "set path = \"%localappdata%\\netwf.dll\"" fullword ascii
$x3 = "%localappdata%\\netwf.bat" fullword wide
$x4 = "KlpSvc.dll" fullword ascii
/* used for generic approach */
$g1 = "set path = \"%localappdata%\\" ascii
$g2 = "%localappdata%\\" wide
$s1 = "start rundll32.exe %path %,#1a" fullword ascii
$s2 = "gshell32" fullword wide
$s3 = "s - %lu" fullword ascii
$s4 = "be run i" fullword ascii
$s5 = "ingToBinhary" fullword ascii
$s6 = "%j%Xjs" fullword ascii
$s7 = "if NOT exist %path % (exit)" fullword ascii
condition:
uint16(0) == 0x5a4d and filesize < 300KB and (
pe.imphash() == "a2d1be6502b4b3c28959a4fb0196ea45" or
pe.exports("KlpSvc") or
( 1 of ($x*) or 4 of them ) or
( $s1 and all of ($g*) )
)
}
rule Sofacy_Oct17_2 {
meta:
description = "Detects Sofacy malware reported in October 2017"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "http://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"
date = "2017-10-23"
hash1 = "ef027405492bc0719437eb58c3d2774cc87845f30c40040bbebbcc09a4e3dd18"
id = "c820eab0-9b64-5718-8681-a4f515ee462b"
strings:
$x1 = "netwf.dll" fullword wide
$s1 = "%s - %s - %2.2x" fullword wide
$s2 = "%s - %lu" fullword ascii
$s3 = "%s \"%s\", %s" fullword wide
$s4 = "%j%Xjsf" fullword ascii
condition:
( uint16(0) == 0x5a4d and filesize < 90KB and (
pe.imphash() == "13344e2a717849489bcd93692f9646f7" or
( 4 of them )
)
) or ( all of them )
}
rule Sofacy_Fybis_ELF_Backdoor_Gen1 {
meta:
description = "Detects Sofacy Fysbis Linux Backdoor"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"
date = "2016-02-13"
modified = "2023-01-27"
score = 80
hash1 = "02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592"
hash2 = "8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb"
id = "c6abf33e-9c5b-5e0f-b7f0-a0741bf9cc3a"
strings:
$x1 = "Your command not writed to pipe" fullword ascii
$x2 = "Terminal don`t started for executing command" fullword ascii
$x3 = "Command will have end with \\n" fullword ascii
$s1 = "WantedBy=multi-user.target' >> /usr/lib/systemd/system/" ascii
$s2 = "Success execute command or long for waiting executing your command" fullword ascii
$s3 = "ls /etc | egrep -e\"fedora*|debian*|gentoo*|mandriva*|mandrake*|meego*|redhat*|lsb-*|sun-*|SUSE*|release\"" fullword ascii
$s4 = "rm -f /usr/lib/systemd/system/" ascii
$s5 = "ExecStart=" fullword ascii
$s6 = "<table><caption><font size=4 color=red>TABLE EXECUTE FILES</font></caption>" fullword ascii
condition:
( uint16(0) == 0x457f and filesize < 500KB and 1 of ($x*) ) or
( 1 of ($x*) and 3 of ($s*) )
}
rule Sofacy_Fysbis_ELF_Backdoor_Gen2 {
meta:
description = "Detects Sofacy Fysbis Linux Backdoor"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"
date = "2016-02-13"
score = 80
hash1 = "02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592"
hash2 = "8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb"
hash3 = "fd8b2ea9a2e8a67e4cb3904b49c789d57ed9b1ce5bebfe54fe3d98214d6a0f61"
id = "d4e3a8bb-b23a-53a4-b5fb-b321a3417b43"
strings:
$s1 = "RemoteShell" ascii
$s2 = "basic_string::_M_replace_dispatch" fullword ascii
$s3 = "HttpChannel" ascii
condition:
uint16(0) == 0x457f and filesize < 500KB and all of them
}
rule APT28_SourFace_Malware1 {
meta:
description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server."
author = "Florian Roth (Nextron Systems)"
reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
date = "2015-06-01"
hash1 = "e2450dffa675c61aa43077b25b12851a910eeeb6"
hash2 = "d9c53adce8c35ec3b1e015ec8011078902e6800b"
score = 60
id = "d4275b8d-384f-58b7-bac5-05fb7db659e2"
strings:
$s0 = "coreshell.dll" fullword wide /* PEStudio Blacklist: strings */
$s1 = "Core Shell Runtime Service" fullword wide /* PEStudio Blacklist: strings */
$s2 = "\\chkdbg.log" wide
condition:
uint16(0) == 0x5a4d and filesize < 62KB and all of them
}
rule APT28_SourFace_Malware2 {
meta:
description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server."
author = "Florian Roth (Nextron Systems)"
reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
date = "2015-06-01"
super_rule = 1
hash0 = "367d40465fd1633c435b966fa9b289188aa444bc"
hash1 = "cf3220c867b81949d1ce2b36446642de7894c6dc"
hash2 = "ed48ef531d96e8c7360701da1c57e2ff13f12405"
hash3 = "682e49efa6d2549147a21993d64291bfa40d815a"
hash4 = "a8551397e1f1a2c0148e6eadcb56fa35ee6009ca"
hash5 = "f5b3e98c6b5d65807da66d50bd5730d35692174d"
score = 60
id = "8a9df742-82c1-56bb-ab70-6384403f70b5"
strings:
$s0 = "coreshell.dll" fullword ascii /* PEStudio Blacklist: strings */
$s1 = "Applicate" fullword ascii
condition:
uint16(0) == 0x5a4d and filesize < 550KB and all of them
}
rule APT28_SourFace_Malware3 {
meta:
description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server."
author = "Florian Roth (Nextron Systems)"
reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
date = "2015-06-01"
super_rule = 1
hash0 = "85522190958c82589fa290c0835805f3d9a2f8d6"
hash1 = "d9c53adce8c35ec3b1e015ec8011078902e6800b"
hash2 = "367d40465fd1633c435b966fa9b289188aa444bc"
hash3 = "d87b310aa81ae6254fff27b7d57f76035f544073"
hash4 = "cf3220c867b81949d1ce2b36446642de7894c6dc"
hash5 = "ed48ef531d96e8c7360701da1c57e2ff13f12405"
hash6 = "682e49efa6d2549147a21993d64291bfa40d815a"
hash7 = "a8551397e1f1a2c0148e6eadcb56fa35ee6009ca"
hash8 = "f5b3e98c6b5d65807da66d50bd5730d35692174d"
hash9 = "e2450dffa675c61aa43077b25b12851a910eeeb6"
score = 60
id = "b49843b9-3a54-5525-958e-ac545cc00bde"
strings:
$s0 = "coreshell.dll" fullword wide /* PEStudio Blacklist: strings */
$s1 = "Core Shell Runtime Service" fullword wide /* PEStudio Blacklist: strings */
condition:
uint16(0) == 0x5a4d and filesize < 550KB and all of them
}